AI-driven automation needs behavioural governance, not identity alone

At a glance

What this is: Netacea says 2026 automated risk will be driven by AI agents, declared scrapers and delegated traffic that extract value and distort commercial systems without behaving like conventional attacks.

Why it matters: This matters to IAM and NHI practitioners because identity labels alone do not govern autonomous or delegated behaviour, so control models have to shift toward intent, context and runtime policy.

Context

Automated traffic is no longer just a bot-management problem. As AI agents, LLM crawlers and delegated automation interact with revenue-critical systems, the security issue shifts from simple access control to governance of behaviour, intent and commercial impact.

For identity and access teams, the key gap is that declared identity does not explain what an automated actor will do once access is granted. That creates a new control problem across NHI, delegated access and human-approved automation, where static allow-lists and block-lists are too blunt to manage real-time adaptation.

Key questions

Q: What breaks when automation is governed only by identity labels?

A: Identity labels cannot show whether an AI agent or crawler is extracting value, distorting pricing or repeating sensitive actions at scale. The control fails because access can be legitimate while behaviour is still harmful. Teams need runtime governance based on intent, sequence and threshold breaches, not just authentication or declared purpose.

Q: Why do declared crawlers and AI agents create economic risk even when they are authorised?

A: Authorisation proves access, not intent. Declared automation can still harvest content, amplify demand signals or probe sensitive commercial assets faster and more persistently than humans. That turns access into an economic governance problem, because the damage comes from repeated behaviour, not from unauthorised entry.

Q: What are the signs that behavioural governance is failing for automated traffic?

A: Look for rapid expansion across sensitive content, repeated revisits, concentration on pricing or inventory pages, and agent workflows that keep optimising after the original purpose is complete. Those patterns show the control plane is still treating automation as static identity instead of dynamic activity.

Q: How should teams govern agentic browsing without blocking useful automation?

A: Use conditional access, step-up verification and policy tiers that reflect purpose, sensitivity and repetition, rather than broad allow or deny rules. The goal is to preserve search, partner and user-driven automation while constraining activity that crosses commercial or security thresholds.

Technical breakdown

Why identity labels fail for agentic traffic

Identity labels answer who or what initiated access, but they do not explain operational purpose, repetition patterns or economic effect. AI agents and crawlers can present legitimate headers, known infrastructure or user-approved delegation while still carrying out extraction, optimisation or distortion at machine speed. That makes identity a weak control signal when behaviour can change within a session. Behavioural governance is therefore about observing sequence, scope, revisit rate and target sensitivity, not simply authenticating the caller.

Practical implication: move enforcement decisions from declared identity alone to runtime behaviour and purpose-aware policy.

Behavioural governance for LLM scraping and delegated automation

LLM scraping and agentic browsing sit between traditional bot abuse and normal user activity. The challenge is that the traffic can be transparent, attributable and technically valid while still creating economic harm through content extraction, pricing intelligence gathering or workload amplification. Governance models need to treat automation as conditional access, with policy that changes as access patterns broaden, revisit sensitive assets or cross commercial thresholds. This is closer to entitlement governance than classic bot blocking, because the question becomes how much, how often and for what objective access is allowed.

Practical implication: define behavioural thresholds for access expansion, not just authentication success or failure.

Bot and Agent Trust Management as a control model

A scalable model has to distinguish benign automation, commercially useful automation and hostile automation without relying on a binary allow-or-block stance. Bot and Agent Trust Management is effectively a policy layer that combines confidence scoring, intent assessment, verification and conditional denial when behaviour drifts outside acceptable bounds. For identity programmes, this intersects with delegated authority, synthetic identities and NHI governance because the same automation may be both attributable and operationally risky. The control point is not just login, but the entire sequence of automated activity.

Practical implication: implement trust scoring and step-up verification for automated actors whose behaviour crosses commercial or security thresholds.

Threat narrative

Attacker objective: The objective is to extract value or influence outcomes from digital systems without triggering traditional bot or identity controls.

1. Entry occurs through apparently legitimate automated access, including AI agents, declared crawlers or delegated workflows that are allowed to interact with business systems.
2. Credentialed or authorised access is then used to collect content, compare prices or repeatedly probe commercially sensitive surfaces at machine speed.
3. The impact is economic distortion rather than a conventional breach, including pricing erosion, demand shaping, content extraction and loss of commercial control.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Behaviour, not identity, is becoming the primary security boundary for automation. Identity tells teams who requested access, but it does not tell them whether the activity is extraction, optimisation or abuse. Once AI agents and crawlers can behave credibly at the point of access, runtime behaviour becomes the decisive control signal. For practitioners, the governance question shifts from authentication confidence to intent and outcome.

Declared automation should no longer be treated as inherently trustworthy. The article is right to separate attribution from control, because many agentic interactions will be visible, authorised and still commercially harmful. That creates a governance trust gap: systems can know what connected, yet remain blind to what the automation is doing with that access. Security teams should expect this gap to widen as agentic traffic scales.

Behavioural governance creates a new class of NHI policy problem. Synthetic identities, delegated automation and AI agents sit inside the same decision path as service accounts and machine identities, but their risk cannot be managed only through lifecycle and privilege checks. The real issue is conditional authority, where access must be shaped by observed purpose and changed when intent drifts. Practitioners need to treat automated actors as governed participants, not static identities.

Bot and Agent Trust Management is a useful named concept because it reflects the actual operating model shift. The article describes a world where access is continuously evaluated, constrained and re-verified according to economic and behavioural signals. That is broader than bot defence and more operational than policy statements. For identity and security programmes, the practical conclusion is that trust must be measured continuously rather than granted once at admission.

From our research library:

• 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
• 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Security Guide

What this signals

Behavioural governance is the missing control layer for agentic traffic. Teams that still rely on static bot rules will struggle as automation becomes more adaptive, more delegated and more commercially consequential. The practical shift is to govern access by observed intent, repeated action and threshold crossing, not by the identity claim alone.

Bot and Agent Trust Management is the right concept for this problem because it combines trust scoring, verification and contextual policy into a single control model. That matters for NHI programmes as much as for bot teams, because synthetic identities and delegated workflows are already crossing into the same decision path.

As agentic traffic expands, security leaders should expect more pressure on IAM, fraud and revenue protection functions to coordinate around the same automation signals. The organisations that do this well will define where automation is welcomed, where it is conditioned and where it must be stopped before commercial harm accumulates.

For practitioners

• Define behavioural access policies for automated actors Set separate policy paths for declared crawlers, AI agents and delegated workflows, with thresholds for content sensitivity, revisit frequency and commercial impact.
• Add runtime intent signals to access decisions Use sequence, asset selection and repetition patterns to decide when an automated session remains within approved purpose and when it needs verification or restriction.
• Treat delegated automation as governed access Map agentic browsing and synthetic identities into IAM and NHI controls so that access reviews, approvals and offboarding include non-human actors.
• Create step-up triggers for economic risk Require extra verification when automation crosses thresholds tied to pricing pages, sensitive metadata, bulk extraction or repeated high-value navigation.
• Separate benign automation from extraction behaviour Define monitoring and response playbooks that distinguish search indexing, partner automation and commercially harmful scraping before enforcement decisions are made.

Key takeaways

• Identity-only controls are no longer sufficient for automation that adapts in real time and interacts directly with business systems.
• The most important risk is shifting from overt breach scenarios to economic extraction, pricing distortion and delegated misuse.
• Practitioners should move toward behavioural governance, step-up verification and trust scoring for automated actors that cross sensitive thresholds.

Key terms

• Runtime Behavioural Governance: Controls that evaluate what an agent is actually doing while it is acting, rather than only what it was allowed to do at provisioning time. For enterprise AI agents, this is the layer that catches intent drift, context loss, and misaligned action execution.
• Agentic Traffic: Traffic generated by software that can act on behalf of a user or process with some degree of independent decision-making. In fraud prevention, it includes both legitimate assistants and malicious automation, so the control question becomes intent and behaviour, not automation alone.
• Bot and Agent Trust Management: Bot and agent trust management is the practice of classifying non-human and AI-assisted traffic so security systems can decide whether to allow, challenge, or block it. It combines identity signals, device evidence, and behavioural analysis to determine intent rather than assuming all automation is hostile.
• Delegated Automation: Delegated automation is machine-executed activity performed on behalf of a person or business process. The control issue is not whether the machine can act, but whether the delegation boundary, approval, and ownership remain valid when the action has financial, account, or security impact.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management for practitioners who need to govern automated access. It is designed for security teams that must align identity controls with real operational risk.